International comparisons of health system performance among OECD countries: Opportunities and data privacy protection challenges

Health Policy 112 (2013) 9–18

Contents lists available at ScienceDirect

Health Policy journal homepage: www.elsevier.com/locate/healthpol

International comparisons of health system performance among OECD countries: Opportunities and data privacy protection challenges夽,夽夽 Jillian Oderkirk ∗ , Elettra Ronchi, Niek Klazinga Organisation for Economic Co-operation and Development, 2, Rue André Pascal, 75775 Paris Cedex 16, France

a r t i c l e

i n f o

Article history: Received 31 October 2012 Received in revised form 14 May 2013 Accepted 7 June 2013 Keywords: Health system performance Data privacy Data protection Data linkage Personal health data International comparisons

a b s t r a c t Objective: Health data constitute a significant resource in most OECD countries that could be used to improve health system performance. Well-intended policies to allay concerns about breaches of confidentiality and to reduce potential misuse of personal health information may be limiting data use. A survey of 20 OECD countries explored the extent to which countries have developed and use personal health data and the reasons why data use may be problematic in some. Results: Countries are divided, with one-half engaged regularly in national data linkage studies to monitor health care quality. Country variation is linked to risk management in granting an exemption to patient consent requirements; in sharing identifiable data among government authorities; and in project approvals and granting access to data. The resources required to comply with data protection requirements is a secondary problem. The sharing of person-level data across borders for international comparisons is rarely reported and there were few examples of studies of health system performance. Discussion: Laws and policies enabling data sharing and data linkage are needed to strengthen national information infrastructure. To develop international studies comparing health care quality and health system performance, actions are needed to address heterogeneity in data protection practices. © 2013 The Authors. Published by Elsevier Ireland Ltd. All rights reserved.

1. Introduction Health data constitute a significant resource in most OECD countries and it makes economic and ethical sense to use these data as much as possible to improve the effectiveness, safety and patient-centeredness of health care

夽 This is an open-access article distributed under the terms of the Creative Commons Attribution-NonCommercial-ShareAlike License, which permits non-commercial use, distribution, and reproduction in any medium, provided the original author and source are credited. 夽夽 Open Access for this article is made possible by a collaboration between Health Policy and The European Observatory on Health Systems and Policies. ∗ Corresponding author. Tel.: +33 1 45 24 76 03; fax: +33 1 44 30 63 61. E-mail address: [email protected] (J. Oderkirk).

systems. Regional, national and international reports on health and health care are entirely dependent upon monitoring policies and investments in data infrastructure that either facilitate or restrict data and analysis [1]. Understanding the quality of health care and the performance of health care systems requires the ability to monitor the same individuals over time, as they experience health care events, receive treatments, experience improvements or deteriorations in their health and live or die. It also requires understanding the distribution of health and health outcomes across different groups in the population and understanding variations in care quality and health outcomes. This work has a few, very important, prerequisites. First it depends on the collection and storage of data at the level of individual patients (for an entire population of patients

0168-8510/$ – see front matter © 2013 The Authors. Published by Elsevier Ireland Ltd. All rights reserved. http://dx.doi.org/10.1016/j.healthpol.2013.06.006

10

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

or for a representative sample). The most common sources of health data are registries, administrative data, population surveys, patient surveys and clinical records. Second, it relies on the capacity to follow individual patients across the care continuum and through different health and health care events to measure change. Following patients through different events often requires the linkage of patient records across datasets. These data can then be used to reduce unsafe practices, to improve guidance to clinicians on the most appropriate care and to make good decisions about the wise use of health care resources. On 7–8 October 2010, Health Ministers from OECD countries met in Paris to discuss how to improve value in health care. In their final communiqué, they underlined the importance of better health information systems [2]. They called for more and effective use of health data that has already been collected. They also recognised the need to reconcile the legitimate concerns of citizens to protect their privacy with the use of health data to improve health system performance and the quality of care. In the development of the OECD programme of health care quality indicator reporting, there was evidence of significant cross-country variability in the extent to which health data resources were being used to monitor and improve health care quality [1]. Well-intended privacy and confidentiality decisions, which aim to allay concerns about breaches of confidentiality and reduce potential misuse of personal health information, may have made a contribution to this variation. In 2008, the Working Group on Data Protection of the EU NCA observed that diverging opinions on how to interpret the EU Data Protection Directive (Directive 95/46/EC) and poor transposition into national data protection laws appeared to be a significant barrier for European public health monitoring and research [3]. The group recommended that best practice examples should be developed to provide guidance on the collection of high quality health data and that the privacy requirements be clarified and harmonised across countries. Further, the group concluded that awareness of data protection issues among public health experts and researchers should also be promoted. Many other individuals and groups – especially medical researchers, public health officials, and health care delivery organisations – have countered that overzealous or misdirected privacy protections are thwarting efforts to use information to improve patient care and public health [4–8].

Health Care Quality Indicators Expert Group1 in July 2011 who were each responsible for coordinating a response on behalf of their country. Responses were received from 20 countries from September 2011 through to March 2012. Questions identified national datasets of personal health information; the availability of patient identifiers; the conduct and regularity of data linkage studies; the focus of data linkage studies; the use of linked data for health care quality monitoring or research; restrictions to data linkage projects and views about the potential for data linkage activities within the next five years. The survey also asked about regional/state level datasets and health care organisation datasets and their use in data linkage studies. Countries participating in the survey included Australia, Belgium, Canada, Cyprus, Denmark, Finland, France, Germany, Israel, Japan, Republic of Korea, Malta, Norway, Poland, Portugal, Singapore, Sweden, Switzerland, the United Kingdom and the United States. This survey also asked officials to identify government experts knowledgeable about the general environment for secondary use of personal health data and national data privacy protection legislations and to identify the leaders of two national projects involving the linkage of health administrative or clinical data that have taken place within the past five years and one multi-country study. If there were no national projects, then sub-national projects could be reported. Structured telephone interviews were then conducted with 1–5 experts in each of 16 countries from September 2011 to March 2012 about legislative requirements and practices for data privacy protection including project approval processes, data linkage, data sharing, data security and data access modalities.2 Written summaries were provided to interview participants for verification. Responses to the OECD country survey and the telephone interviews were consolidated into an OECD report that was reviewed by countries’ health officials in both 2012 and 2013 and revised to reflect country comments [9]. 3. Results 3.1. Information infrastructure for data linkage appears strong There is a strong underlying infrastructure for analysis of personal health data within the countries participating in this study (Table 1). Most reported to the OECD survey that national datasets with individual-level records are available across the spectrum of health care administration, as well as from population health surveys and

2. Methods In 2011/12, the OECD undertook a study to better understand the challenges, the opportunities and the practices in the use of data to monitor and describe pathways of care and health care outcomes to enable health care quality and health system performance monitoring and research [9]. A mail-back questionnaire sought information about the general environment in each country for the secondary use of personal health data as well as specific case studies. The questionnaire was sent to the members of the OECD

1 Members of the Health Care Quality Indicators Expert Group represent the 34 member countries of the Organisation for Economic Cooperation and Development as well as a number of non-member countries who are participating actively in the HCQI project. 2 The countries were Australia, Belgium, Canada, Cyprus, Denmark, Finland, France, Germany, Italy, Japan, Korea, Singapore, Sweden, Switzerland, the United Kingdom and the United States. All participants are identified in Annex B of the report Strengthening Health Information Infrastructure for Health Care Quality Governance: Good Practices, New Opportunities and Data Privacy Protection Challenges [9]. Italy identified respondents to participate in the telephone interview, but did not submit a response to the OECD country survey.

4 5

11

registries/censuses. In such datasets, each row of the dataset represents an individual patient or person. To follow patients through the care pathway, and thus from one dataset to another, identifying variables are also required. Many countries have a unique patient identifying number or UPI available for patients or persons within national hospital in-patient, primary care, cancer registry, prescription medicines and mortality datasets (Table 1). A greater number of countries reported other identifying variables, such as names, dates and addresses that may also be used to enable data linkages. In Australia, Canada, Germany, Israel, Portugal, Sweden, and the United States, the health information infrastructure for data linkage was reported to be stronger or more developed sub-nationally, at the regional/state/provincial level or within networks of health care organisations.

4

7 7

11

10 8

11

12 15

16

11 12

11

17 14

17

20 17

20

Population health survey data

1 4 12

Source: OECD HCQI Country Survey, 2011/12.

12 4 12

7

1 6 16 12 8 12

10

1 11 16 12 10 14

14

3 12 17 12 12 15

17

1 11 15 12 12 15

14

7 13 18 12 17 13 17

18 16 20

14

20

16

11

3.2. From data to evidence for health system improvement

National dataset available. . . Contains records for patients or persons Contains a UPI that could be used for data linkage Contains other identifying variables that could be used for data linkage Is used for data linkage studies Is used regularly for data linkage studies Is used regularly for data linkage studies to monitor health care quality

Cancer registry data Primary care data Hospital in-patient data

Table 1 Number of countries reporting linkable data and reporting data use.

Prescription medicines data

Mortality data

Formal long-term care data

Patient experiences survey data

Mental hospital in-patient data

Population census or registry data

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

There were several examples provided by respondents to the OECD country survey of the linkage of personal health data to follow the pathway of care and evaluate the quality and effectiveness of health care treatments. The PERFECT study [10,11] in Finland monitors the content, quality and cost-effectiveness of treatment episodes in specialised medical care and thus contributes to monitoring health-system performance. Indicators and models were created to monitor the whole cycle of care and outcomes for disease groups and procedures (stroke, premature newborns, hip fracture, breast cancer, schizophrenia, acute myocardial infarction, and orthopaedic endoprosthesis including hip and knee replacement surgery, and invasive heart surgery). Results have contributed to changes in law and government policy and have been used within hospitals to improve the quality of care [12]. The Republic of Korea’s quality assessment of medical services includes assessment of the clinical appropriateness and cost effectiveness of health care by reporting on quality and inducing service providers to make improvements in response to the evidence [13]. Indicators include 30-day case fatality for acute myocardial infarction; 30day post-operative mortality for major types of surgery; hospital re-admissions for mental-health patients; prescribing patterns and outcomes in primary care; and health outcomes of prescribing to mental-health patients. The program aims to identify underuse, overuse and misuse of therapies and to reduce variation in care practices through the regular reporting of quality indicators. There are also quality and efficiency assessments of clinical care guidelines in Sweden [14]. For areas of care subject to national guidelines, such as cardiac and stroke care, data linkages are undertaken to develop indicators to evaluate the effectiveness of recommended therapies and the evidence contributes to revisions of the care guidelines. In Germany there are projects to evaluate the effectiveness and safety of breast cancer screening [15]. A new follow-up of both women who participated in a clinical trial involving screening and those who were unscreened will assess the benefits and potential adverse effects of exposure to mammography screening to provide evidence

12

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

to develop early detection guidelines for mammography screening. Belgium also has several studies underway where data linkages are generating new information about quality of care and outcomes for cancer patients [16,17]. Israel is linking data to examine quality of care for colon surgery patients by measuring post-operative infections, re-hospitalisations and deaths. Israel has also explored mortality among psychiatric patients in order to improve community mental health care [18]. Data linkage projects in the United Kingdom were initiated to overcome gaps in existing information to provide a more comprehensive and consistent picture of maternity outcomes [19,20]. England monitors hospital standardised mortality ratios that will be replaced, in future, with a summary hospital-level mortality indicator. England produces a 30-day post-operative mortality rates for patients following colorectal cancer surgery. Scotland reports using linkage to monitor readmissions and deaths among coronary heart disease patients. Australia has explored care transitions for older people with chronic health conditions including the factors influencing pathways and, particularly the entry into residential care [21]. A new study in Australia is investigating the health effects of exposure to low-dose radiation from CT scans in childhood. To extend the information available about pathways of stroke care beyond the acute care setting, a pilot data linkage project is underway in Canada [22]. Denmark is exploring wait times in cancer treatment pathways. Singapore reports a national program to monitor the quality of primary care for chronic disease management by examining health care providers’ adherence to recommended care processes as well as their success in preventing hospitalisations related to chronic conditions [23]. 3.3. Building foundational platforms to support health system performance research There are also initiatives underway to build a firmer foundation upon which studies of health system performance may be based. To monitor and study health care consumption and expenditures to inform policy decisions, Belgium and France have developed a permanent sample of socially insured persons via the linkage of health care reimbursement invoice data to create longitudinal histories of health care encounters [24,25]. In Switzerland, a linkage of population census data and mortality data is enabling a better understanding of the socio-economic and socio-demographic characteristics of mortality and life expectancy and forms a base cohort from which additional data may be linked for specific, approved, studies, such as socio-demographic differences in cancer survivorship and outcomes [26]. In the United States, the National Center for Health Statistics has built a platform to support health and health services studies, including a repository of surveys that have been prepared to support linkage projects and two key linkages: the linkage of population health survey data to mortality data; and the linkage of population health survey data to data on health care encounters for Medicare

and Medicaid insurance beneficiaries [27]. In the United Kingdom, there is a national initiative to support health care quality improvement by facilitating research involving personal health data that are in the public’s interest. The service can both produce tabulations and conduct data linkages on behalf of clients with approved projects [28]. In Australia, the Population Health Research Network, with funding from the Australian Government, is building infrastructure for record linkage in all states and territories and also at the national level in order to improve the way data are exchanged and accessed [29]. 3.4. Country variation in the decision to regularly undertake data linkage studies Data linkages often depend on the sharing of data across authorities in custody of data and require the amalgamation of patient-level information from two or more distinct datasets. Both the sharing and the linkage of data place risks on the protection of the privacy of the persons whose data are involved. Table 2 presents results of the OECD country survey regarding the variability across countries in the use of personal health data for regular health and health care monitoring requiring data linkages.3 Seven countries involve many national datasets in data linkage projects on a regular basis. In all but one of these countries, a unique patient identifying number is available to facilitate the linkages (Table 2). The United States relies more on sets of patient identifying information, such as names, dates and addresses, to establish links. Australia, Belgium, France, and Switzerland also undertake projects involving the linkage of several datasets on a regular basis. Belgium has a greater ability to conduct these linkages using a unique patient identifying number, while other identifiers are more often used in Australia. France is challenged in data linkages due to the use of two different patient UPIs across its key datasets. Canada, Malta and Norway conduct regular data linkage projects with some datasets and use a unique identifying number to undertake the work. Cyprus, Portugal and Singapore have national datasets with patient identifying numbers and/or other patient identifiers, but engage in data linkage on a regular basis with only two of the available datasets. Germany, Switzerland, Japan and Poland all have national datasets with variables that could be used to undertake data linkage projects, but none do so regularly. Just over half of countries reported regularly monitoring health care quality through the linkage of their hospital inpatient, cancer registry, and mortality data and less than half of countries with their prescription medicines data (Table 1). Regular linkage studies to monitor the quality of primary health care, mental hospital in-patient care and formal long-term care remain relatively rare, with only 4–5 countries reporting undertaking such work with national datasets.

3 Further description of these data linkages is provided in chapters 2 and 3 of the OECD report Strengthening Health Information Infrastructure for Health Care Quality Governance: Good Practices, New Opportunities and Data Privacy Protection Challenges [9].

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

13

Table 2 Distribution of the regular occurrence of health-related record linkage projects by availability of datasets with patient identifiers. Most national data with a unique patient identifying number (UPI) Data linkage projects on a regular basisa with. . . Denmark, Finland, Israel, 7+ national datasets Korea, Sweden, United Kingdom 5–6 national datasets France, Belgium Canada, Malta, Norway 3–4 national datasets 2 national datasets Singapore No national datasets Japan

Most national data with other patient identifiers

Some national data with a unique patient identifying number (UPI)

United States

Australia

Switzerland Cyprus, Portugal Poland, Germany

Source: OECD HCQI Country Survey, 2011/12. a Regular basis was defined as a record linkage study using this dataset is usually underway.

3.5. Country variation linked to differences in risk management in the decision process Risk management in any decision-making process involves identifying the risks and evaluating their potential costs and benefits [30]. It does not imply avoiding all risks, but making an informed decision under uncertainty. Uncertainty is unavoidable in decision-making about the collection and use of personal health data. Nonetheless, avoiding or delaying decision-making carries its own risks, in terms of compromising patient safety and the quality of health care. The core challenge is for countries to identify and weigh the tradeoffs among data risks and data utilities. This balance is reflected in Fig. 1 as the point where best practices in data collection, linkage and analysis are identified and implemented, providing the optimum risk/return trade-off. This trade-off will be specific to the context of individual countries. This OECD study revealed three key areas where significant cross country differences in the use of personal health data could be attributable to differences in risk management: use of personal health data when obtaining patient consent is impossible or cost prohibitive; sharing of identifiable personal health data among government authorities, and approval of projects involving the linkage of personal health data. The resources required to comply with legislative and policy requirements to enable data linkages is a secondary problem, as is the cost of developing the technical capacity to undertake the work. 3.6. Use of patient data when patient consent is impossible or cost prohibitive Informed consent has become the pillar for protecting individual’s autonomy where research involves human subjects. Informed consent requirements in legislation build from professional codes of practice. Informed consent presumes the ability to indicate clearly to a participant the use and the purpose of a particular research activity [31]. This is feasible for a purpose-specific study, such as an invitation to patients to participate in a clinical trial or a survey. The requirement to obtain patient consent presents significant challenges, however, for health and health care monitoring and research involving large, historical population and patient datasets. These datasets were originally

collected for other purposes, such as administering the health system or providing clinical care and represent hundreds of thousands to millions of persons. The retrospective collection of patient consent implies that useable data will be biased towards non-movers and healthier/younger patients, which can compromise the validity and the utility of the findings. Further, attempting to reach large cohorts can be impractical and requires, often significant, financial resources. This OECD study found considerable variability across countries in responding to the problems involved in retrospective patient consent for studies requiring the linkage of patient records among historical and large personal health datasets. While some allow for exemptions to patient consent requirements for projects in the public interest, others do not. While providing a unifying framework, the EU Data Protection Directive (Directive 95/46/EC) left considerable freedom to EU countries regarding whether to apply, restrict or extend the rules on processing sensitive data. Experts in several European countries indicated that approval to use the data without patient consent would be granted at the level of the national data protection office and that it is very difficult to obtain approval without first introducing authorising legislation for the project itself (Belgium, Italy, and Cyprus). Experts in Germany noted that personal health data may only be used with patient consent or when authorised by law or regulation. Further, new legislation authorising a project may be required at the state level, depending on the data involved. Portugal reported to the OECD country survey that record linkage is illegal in the absence of authorising legislation. Poland reported to the country survey that it has not established a legal basis for national data linkages and has no reportable national data linkage projects. Experts from other European countries (France, Sweden, Denmark, Finland and the United Kingdom) indicated that their data protection legislation sets out the framework within which identifiable data may be processed without informed consent. In these countries, decision-making on individual projects may be delegated to data custodians or to national approval bodies who weigh the risk trade-off between individual privacy and monitoring and research that is in the public’s interest. Experts in other federated countries, such as the United States, Canada, and Australia reported a complex web of

14

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

Fig. 1. Continuum of risk in the decision to share and to link personal health data for health care quality and system performance monitoring and research.

legislations at the level of the nation, states/provinces, and local areas. In general, national data custodians in these countries may have their role incorporated within legislation that then enables them to set up an internal process for decision-making for individual projects. In Australia, guidelines issued by the National Health and Medical Research Council [32] provide a framework for the conduct of medical research using information held by Commonwealth agencies where identified information needs to be used without consent. Approval of projects must be obtained through a Human Research Ethics Committee. Experts from the Republic of Korea and Singapore reported legislative frameworks that set out conditions where public data custodians may process personal health data without consent. Experts from Japan, on the other hand, reported that Japan has not established a legal basis for national data linkages and has no reportable national data linkage projects. 3.7. Sharing of identifiable personal health data among government authorities Datasets of key health information may be in the custody of various actors within countries. Each of these custodians has the authority necessary to collect, analyse and disseminate information for monitoring health and health care and play a critical role in decisions about data

use. The OECD country survey found that all countries reported that there are several national governmental authorities, agencies or organisations acting as custodians of their key national person-level datasets. The only exception was Switzerland, where the key datasets identified in this survey were all under the custody of the Federal Statistical Office. Thirteen countries reported having 70% or more of their national datasets in the custody of two national organisations, typically the health ministry and the statistical ministry; while in the other seven countries, data were less centralised. Commonly reported custodians included government ministries, insurers, agencies, research institutes, and registries. In some countries, custodianship of certain key datasets for national projects is at a sub-national level (such as in the United Kingdom, Australia, Canada, Italy, and Germany). Where there are multiple data custodians, there must also be legal frameworks and information custodian policy frameworks that provide for the possibility of sharing identifiable personal health data. Several country experts interviewed described difficulties in negotiating data sharing arrangements among government ministries, where negotiations were either unsuccessful or it took years to negotiate agreement. Concerns about legislative barriers hindering the sharing of identifiable personal health data were signalled by experts interviewed from Cyprus and Italy and were reported to the OECD country survey by Poland and Portugal. Lengthy

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

and complex processes to reach agreement for data sharing among public authorities were reported by experts interviewed from the United States, Canada, Australia and Germany. 3.8. Approval of data linkage studies In all countries where governments engage in linkages of personal health data, experts interviewed described processes to consider approval of data linkage projects proposed by researchers within and outside of government, such as academic researchers. There are variations across countries in the decision-making authority for projects. Some country experts indicated that the decision to approve the use of personal health data for a data linkage project would be made at the level of the data custodian (Australia, Canada, Singapore, Finland, Sweden, United Kingdom (Scotland) and the United States). A smaller number of country experts noted that the approval of data linkage projects was delegated to a national authority. In Belgium, Finland and Denmark, experts explained that the national data protection authority approves data linkage projects proposed by government ministries and by private entities. In the United Kingdom (England and Wales), experts explained that the National Information and Governance Board approved projects to be undertaken in the public sector and by private entities where the use of personal data is not authorised by law and where the consent of data subjects was not obtained. Since April 2013, however, these responsibilities have passed to the Health Research Authority [33]. In some countries with decentralised administration of health, and therefore data custodians at the sub-national level, experts described decentralised decision-making on the approval of projects involving personal health data (Australia, Canada, Germany, Italy and the United States). For example, in Australia, an expert explained that there are efforts underway to permit data collected and linked at the state level to be amalgamated at the national level, creating the potential for analysis and reporting at a national level and also for data linkage projects with national data in the custody of the Australian Institute for Health and Welfare. The project is challenging because legislation and governance vary across the Australian states. 3.9. Use of personal health data in multi-country projects Multi-country studies can provide a rich source of information for the benefit of the public’s health and the management of health systems. Multi-country projects also pose challenges for data protection, as the data custodians involved typically have no legal recourse to exert any penalties for misuse of data by a foreign entity. Multicountry projects are also difficult for research teams to implement, as the data protection requirements of each participating data custodian must be respected. Some EU country experts interviewed noted that their data protection legislations make it possible to share identifiable data with another EU country. Respondents from the U.K. and France also noted that non-EU countries can be reviewed for equivalency of their data protection

15

legislative framework to that of the EU in order to also qualify to share data. Nonetheless, few European country experts reported engaging in projects where de-identified micro data were shared across borders. Denmark’s National Board of Health has contributed de-identified individual data to multi-country studies with other Scandinavian countries. Outside of Europe, there were also few possibilities reported. Experts from the United States National Centre for Health Statistics expressed that they can provide a foreign researcher with access to de-identified individuallevel data, however, the process of de-identification is very strict and not all data can be de-identified. There were examples provided by countries responding to the OECD survey of parallel studies where researchers within several countries each independently conducted analysis of linked personal health data following a common study protocol [34–37]. Most of these studies were related to cancer treatment outcomes and survivorship. The European Health Care Outcomes, Performance and Efficiency project (EuroHOPE) stands out as it aims to evaluate the performance of European health care systems in terms of outcomes, quality use of resources and costs through the linkage of hospital, pharmaceutical, cancer registration and mortality datasets and the EUropean Best Information through Regional Outcomes in Diabetes (EUBIROD) project stands out as it aims to implement a sustainable European diabetes register [38,39]. EuroHOPE is limited to six European countries that all had the health information infrastructure and legal frameworks necessary to enable the data linkages. While diabetes registries are available across Europe, EUBIROD was challenged to find common ground where local requirements for data security and privacy were respected [40,41]. The EUBIROD team concluded that the sharing of de-identified micro data would not be possible for their project without limiting the participation in the registry to a small number of countries. The solution was the development of a system where each diabetes registry could submit aggregated information with very little re-identification risk. 3.10. Resource constraints and options to improve efficiency in meeting data protection requirements In many countries, experts interviewed indicated that data custodians are responsible for vetting project proposals for the use of data from government and private entities; maintaining a technical capacity to undertake data linkages and to de-identify data; providing data access modalities to internal and external researchers; and ensuring that through all of their activities the legal requirements for data security and data privacy protection are respected. Experts from several countries noted that fulfilling these responsibilities is expensive and that pressure is mounting to trim expenditure. Further, expenses are particularly heavy in countries with decentralised administration of the health system. In these countries, data custodians at subnational levels are also carrying out these responsibilities. In all countries participating in the study, experts indicated that data security and the protection of data confidentiality are given considerable attention by data

16

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

custodians. It was common for experts to report that their institution’s existence or its ability to continue its programme of work would be placed at risk by a serious breach of data security. Nonetheless there is variation across data custodians in the data security measures that have been put into place. Challenging areas reported by experts included finding acceptable mechanisms to de-identify data, so that it can be accessed and used for monitoring and research and still protect privacy; and finding appropriately safe mechanisms to give government researchers and academic researchers access to the data. At one end of the spectrum, there are custodians who reported managing their risk by refusing to provide access to data for research and monitoring to be undertaken by another government ministry or an academic researcher. On the other end of the spectrum, there are custodians who reported that identifiable personal health data may be shared with external researchers. A few country experts provided interesting examples of centralising the difficult tasks of linking data, deidentifying data, approving access to data and supervising access to data. In the United Kingdom [42,43], Belgium [44,45], Australia [46], Korea [47], Canada [48] and Finland, trusted third parties have been engaged to conduct data linkages and to de-identify linked data for use by government and external researchers. The development of dedicated linkage centres is a strategy that could be further explored to both enhance and standardise data privacy protection and to reduce costs otherwise born by individual data custodians. The United States [49], Canada [50] and Singapore have established secure supervised facilities where researchers can access de-identified data that carries a higher re-identification risk. Experts from the United States [51] and Australia [52] also reported having established a secure remote data access option for researchers where they may submit programmes to analyse de-identified data and receive outputs. Canada is piloting this approach [53] and such an approach is part of a new initiative in the United Kingdom (Scotland) [54]. 4. Discussion The availability of person-level data across the health care continuum, with unique patient identifiers, provides a foundation upon which programs of health system performance monitoring and research with this data may be developed across OECD countries. There are significant challenges to overcome, however, before all countries can realise the benefits from analysis of their information resources. Some countries have not built a legislative framework or a policy framework for data protection that offers the possibility for an exemption to the requirement of patient consent for projects in the public’s interest. The consequence of managing risk to individual’s data privacy by requiring re-contact to obtain patient consent from large population cohorts or requiring a new legislation to be passed to authorise a project where re-contact is not practical; is that it is very unlikely that there will be comprehensive and evolving programs of health and health care quality monitoring that benefit from the countries’ existing information assets.

Another key element of this issue involves defining what constitutes acceptable patient consent as countries move forward to collect new population health and health care administrative data that may be used for future health and health-care monitoring and research. More generalised patient consent approaches would enable a broader range of future monitoring and research. Many countries with weaker health information infrastructure for data linkages have decentralised the administration of health systems and have not reached a consensus within the country of how the levels of government could work together. Data from decentralised systems must be brought together to support national information infrastructure and capacity for data linkages at the level of the country. When data-sharing agreements take years to negotiate or cannot be negotiated, there will be considerably fewer initiatives to monitor and report on health and health care quality requiring data linkages. If, as a result of a lack of centralisation, government ministries and private entities must seek approval from many different data custodians to conduct one project, it will be very difficult to undertake a national project involving the use of personal health data. Data custodians are challenged in meeting all of the requirements of data protection legislations and policies, due to resource constraints and a lack of recognised best practices in difficult areas such as data de-identification processes, and secure data access modalities. Further complicating the approval process are factors such as inconsistent or unavailable communication from data custodians on the process to seek approval, on the requirements of an applicant, or on the access modalities that are possible. New forms of centralised approaches to project proposal review and data linkage services are very interesting developments. Not only do these help to standardise requirements and practices for both the government and external researchers, they have the potential to be more efficient. Managing risk is clearly difficult in the area of multicountry projects and there has been little progress. The benefit of developing legal and practical mechanisms to enable multi-country projects to proceed in a manner that minimises risks to the privacy of personal health data would be to promote improvement across OECD countries in patient safety and health system performance. Further, it is very difficult to understand and uncover data quality problems in international data comparisons when the underlying data cannot be viewed or evaluated. A role for the OECD in the coming years is to continue to support countries in reaching the goal of strengthening health information infrastructure so that privacy-respectful uses of data for health, health care quality and health system performance monitoring and research become widespread, regular activities. Further, the OECD can contribute to assuring that national health information infrastructure becomes better capable of supporting multi-country monitoring and multi-country research. On-going monitoring of the development of health information infrastructure will help to promote shared learning about advancements and challenges in the

J. Oderkirk et al. / Health Policy 112 (2013) 9–18

development and use of health data; promote international comparability of data and data linkages; and uncover new opportunities for the development of internationally comparable indicators of the quality of care and health system performance. Another important step will be to support countries in reducing unnecessary obstacles to data use that can arise from differences in legislations regarding the protection of health information privacy and/or differences in the interpretation of what is necessary and helpful to assure that patients’ privacy rights are respected in the conduct of health monitoring and research. The OECD is working in 2013/14 to classify data uses according to their risk to patient’s information privacy and to associate recommended data privacy protection practices that can enable, even very sensitive data, to be used safely. Further international action is needed to address heterogeneity in privacy protections in order to support all countries in developing regular, privacy-respectful, statistical and research uses of data and to promote the advancement of internationally comparative indicators and evidence to improve health care quality and health system performance. This effort is particularly important now as there are legislative reforms on the horizon in many countries, including a new EU Data Protection Regulation to be translated into legislation within EU member states, which have the potential to enable or restrict statistics and research over the next decade. Disclosure statement There are no conflicts of interest to report. Acknowledgements The Authors would like to acknowledge the contributions of the members of the OECD Health Care Quality Expert Group and the members of the OECD Health Committee. The opinions expressed in this article are those of the authors alone; not those of the OECD, nor of its Member countries. All errors are the responsibility of the authors.

[9]

[10] [11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

References [25] [1] OECD. Improving value in health care: measuring quality. OECD Health Policy Studies; 2010. [2] OECD.Meeting of the Health Committee at the Ministerial Level Final Communiqué, 7–8 October. 2010. http://www.oecd.org/newsroom/ 46163626.pdf [accessed 09.10.12]. [3] Verschuuren M, Badeyan G, Carnicero J, Gissler M, Asciak RP, Sakkeus L, et al. The European data protection legislation and its consequences for public health monitoring: a plea for action. European Journal of Public Health 2008;18(6):550–1. [4] Peto J, Fletcher O, Gilham C. Data protection, informed consent and research. medical research suffers because of pointless obstacles. British Medical Journal 2004;328:1029–30. [5] Holman CDJ. The impracticable nature of consent for research using linked administrative health records. Australia and New Zealand Journal of Public Health 2001;25:421–2. [6] Rahu M, McKee M. Epidemiological research labelled as a violation of privacy: the case of Estonia. International Journal of Epidemiology 2008;17:678–82. [7] Mladovsky P, Mossialos E, McKee M. Improving access to research data in Europe. British Medical Journal 2008;336(7639):287. [8] Carinci F, Di Iorio CT, Ricciardi W, Klazinga N, Verschuuren M. Revision of the European data protection directive: opportunity or threat

[26]

[27]

[28]

[29] [30]

[31] [32]

17

for public health monitoring? European Journal of Public Health 2011, December;21(6):684–5 [Epub 2011, July 23]. OECD. Strengthening health information infrastructure for health care quality governance: good practices, new opportunities and data privacy protection challenges. Paris: OECD Health Policy Studies; 2013, June. Häkkinen U. The PERFECT project: measuring performance of health care episodes. Annals of Medicine 2011;43(Suppl. 1):S1–3. Peltola M, Juntunen M, Häkkinen U, Rosenqvist G, Seppälä TT, Sund R. A methodological approach for register-based evaluation of cost and outcomes in health care. Annals of Medicine 2011;43(Suppl. 1):S4–13. Häkkinen U, Malmivaara A, Sund R. PERFECT – conclusions and future developments. Annals of Medicine 2011;43(Suppl. 1): S54–7. Health Insurance Review and Assessment Service. Seoul: Quality Assessment Service; 2011. http://www.hira.or.kr/eng/activity/01/ 04/activity01 04.html [accessed 30.04.12]. Socialstyrelsen. Quality and efficiency in Swedish health care, vol. 30. Stockholm: Socialstyrelsen; 2010. http://www.socialstyrelsen.se/ Lists/Artikelkatalog/Attachments/18336/2011-5-18.pdf [accessed 30.04.12]. Obi N, Waldmann A, Babaev V, Katalinic A. Record linkage of a large clinical practice patient cohort with the Cancer Registry SchleswigHolstein. Gesundheitswesen 2011 2011;73(7):452–8. Stordeur S, Vrijens F, Beirens K, Vlayen J, Devriese S, Van Eycken E. Quality indicators in oncology: breast cancer. Brussels: KCE Reports; 2011. p. 150C. Vlayen J, Vrijens F, Beirens K, Stordeur S, devriese S, Van Eycken E. Quality indicators in oncology: testis cancer. Brussels: KCE Reports; 2011. p. 149. Haklai Z, Goldberger N, Stein N, Pugachova I, Levav I. The mortality risk among persons with psychiatric hospitalizations. Israel Journal of Psychiatry & Related Sciences 2011;48(4):230–9. Moser K, Stanfield K, Leon D. Birthweight and gestational age by ethnic group, England and Wales 2005: introducing new data on births. Health Statistics Quarterly 2008;39:22–31. Welsh Government. Adding value to the analysis of Welsh data; birth 2008. http://wales.gov.uk/docs/statistics/2010/ 101215addingvalueen.pdf [accessed 30.04.11]. Australian Institute of Health and Welfare, Bulletin no. 88, Cat. no. AUS 137 Pathways in aged care: do people follow recommendations? Canberra: AIHW; 2011. Canadian Institute for Health Information. Pathways of care for people with stroke in Ontario. Ottawa; 2012. https://secure.cihi.ca/ [accessed estore/productFamily.htm?locale=en&pf=PFC1695 09.10.12]. Ministry of Health. Medisave for chronic disease management programme (CDMP) – the third year. Singapore: Ministry of Health; www.moh.gov.sg/content/moh web/home/Publications/ 2011. information papers/2010/medisave for cdmp-thethirdyear.html [accessed 30.04.12]. Commission Technique d’Échantillon Permanent au Conseil Général de l’INAMI. Echantillon Permanente Steekproef 1/19, Annexe – CGSS 2011/097, Belgium; 2011. www.riziv.fgov.be/information/fr/ sampling/pdf/report.pdf [accessed 06.04.12]. Tuppin P, de Roquefeuil L, Weill A, Ricordeau P, Merlière Y. French national health insurance information system and the permanent beneficiaries sample. Revue d Épidémiologie et de Santé Publique 2010;58(4):286–90. Spoerri A, Zwahlen M, Egger M, Bopp M. The Swiss national cohort: a unique database for national and international researchers. International Journal of Public Health 2010;55:239–42. Centers for Disease Control Prevention. National Center for Health Statistics Data Linkage Activities. Hyattsville: Centers for Disease Control Prevention; 2012. http://www.cdc.gov/nchs/ data access/data linkage activities.htm [accessed 10.10.12]. National Health Service. The Information Centre for Health and Social Care. London: Data Linkage Centre; 2012. http://www.ic.nhs.uk/ services/data-linkage-service [accessed 10.10.12]. Population Health Research Network; 2013. www.phrn.org. au/about-us [accessed 01.05.13]. International Standards Organisation. Risk management principles and guidelines. ISO/DIS 31000:2009; 2009. Standards Catalogue TC262 Risk Management. OECD. OECD policies for information security and privacy. Paris: OECD; 2009. Australian Government. National statement on ethical conduct in human research 2007 – Updated 2009; 2007. www.nhmrc.gov.

18

[33] [34]

[35] [36]

[37]

[38] [39] [40]

[41]

[42]

J. Oderkirk et al. / Health Policy 112 (2013) 9–18 au/ files nhmrc/publications/attachments/e72 national statement 130207.pdf [accessed 02.05.13]. Health Research Authority; 2013. http://www.hra.nhs.uk/ [accessed 01.05.13]. Van Klaveren RJ, Oudkerk M, Prokop M, Scholten ET, Nackaerts K, Vernhout R, et al. Management of lung nodules detected by volume CT scanning. New England Journal of Medicine 2009;361: 2221–9. EUROCARE; 2012. www.eurocare.it [accessed 25.04.12]. Coleman MP, Forman D, Bryant H, Butler J, Rachet B, Maringe C, et al. Cancer survival in Australia, Canada, Denmark, Norway, Sweden, and the UK, 1995–2007 (the International Cancer Benchmarking Partnership): an analysis of population-based cancer registry data. Lancet 2011;377(9760):127–38. Wahlbeck K, Westman J, Nordentoft M, Gissler M, Laursen TM. Outcomes of Nordic mental health systems: life expectancy of patients with mental disorders in Denmark, Finland and Sweden 1987–2006. British Journal of Psychiatry 2011;199(6):453–8. EuroHOPE; 2012. http://www.eurohope.info/ [accessed 10.10.12]. EUBIROD; 2011. www.eubirod.eu/index.html [accessed 25.10.11]. Di lorio CT, Andány R, Azzopardi J, Battelino T, Beck P, Boran G, et al. Privacy impact assessment report, EUBIROD Consortium; 2010. www.eubirod.eu/documents/downloads/D5 2 Privacy Impact Assessment.pdf [accessed 25.10.11]. Di Iorio CT, Carinci F, Brillante M, Azzopardi J, Beck P, Bratina N, et al. Cross-border flow of health information: is “privacy by design” enough? Privacy performance assessment in EUBIROD. European Journal of Public Health 2012 [Epub May 4]. Health and Social Care Information Centre; 2013. www.hscic.gov.uk/ datalinkage [accessed 01.05.13].

[43] Clinical Practice Research Datalink; 2013. http://www.cprd.com/ intro.asp [accessed 01.05.13]. [44] Agence Intermutualist (in French and Dutch); 2013. www.nic-ima. be/fr/imaweb/home/index.html [accessed 01.05.13]. [45] Belgian e-Health Platform; 2013. www.health.fgov.be/eportal/ Healthcare/Telematics/Links/eHealth/?fodnlang=en#.UYKPM9Ynq 4Q [accessed 01.05.13]. [46] Population Health Research Network, Centre for Data Linkage; 2013. http://www.phrn.org.au/participants/centre-for-data-linkage [accessed 01.05.13]. [47] OECD. OECD reviews of health care quality: raising standards: Korea. Paris: OECD; 2012. [48] Canadian Institute for Health Information. Privacy policy on the collection, use, disclosure and retention of personal health information and de-identified data; 2010. www.secure.cihi.ca/free products/ Privacy Policy Revised July 2011 en.pdf [accessed 02.05.13]. [49] National Centre for Health Statistics Research Data Centre; 2013. www.cdc.gov/rdc/ [accessed 02.05.13]. [50] Canadian Research Data Centre Network; 2013. http://www.rdccdr.ca/ [accessed 02.05.13]. [51] National Center for Health Statistics, Remote Access; 2013. http://www.cdc.gov/rdc/B2AccessMod/Acs230.htm [accessed 02.05.13]. [52] Secure Unified Research Environment; 2013. www.sure.org.au/ [accessed 01.05.13]. [53] Doherty K, Price D. Statistics Canada’s real time remote data access solution. In: UNECE/OECD/EC Meeting on the Management of Statistical Information Systems (MSIS 2011), 23–25 May. 2011. [54] Scottish Informatics Program Data Access; 2013. www.scot-ship.ac. uk/data-linkage [accessed 02.05.13].